CVE-2026-1529: Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
Other sources
Organization invitation tokens in Keycloak are parsed without cryptographic signature verification during the registration flow. This allows an attacker to take a legitimate invitation, modify the organization ID (orgid) and the target email (eml) within the JWT payload, and successfully self-register into an unauthorized organization.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.4.9 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.2.13 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.5.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1529?
CVE-2026-1529 has been classified as a high severity vulnerability due to its potential for unauthorized organization registration.
How do I fix CVE-2026-1529?
To fix CVE-2026-1529, update your Red Hat Keycloak installation to the latest version that addresses this vulnerability.
Who is affected by CVE-2026-1529?
Organizations using Red Hat Keycloak are affected by CVE-2026-1529 if they utilize invitation tokens without proper validation measures.
What type of attack does CVE-2026-1529 allow?
CVE-2026-1529 allows an attacker to exploit improper invitation token validation, enabling unauthorized organization registration.
What mitigation steps can be taken for CVE-2026-1529?
Mitigation steps for CVE-2026-1529 include ensuring proper validation of invitation tokens and monitoring for unauthorized access attempts.